MariaDB 安全漏洞

MariaDB is a free and open source database management system from the MariaDB Foundation and a forked version of MySQL with the Maria storage engine. A security vulnerability exists in MariaDB Server v10.7 and lower, which stems from the inclusion of a global buffer overflow in the component...

Interest accrued could be zero for small decimal tokens

Lines of code Vulnerability details Details & Impact Interest is calculated as principal.mulborrowRate.multimeElapsed.divYEARINSECONDS.divSCALINGFACTOR; It is possible for the calculated interest to be zero for principal tokens with small decimals, such as EURS 2 decimals. Accumulated interest ca...

Incorrect strike price displayed in name/symbol of qToken

Lines of code Vulnerability details Impact slice in options/QTokenStringUtils.sol cut a string into stringstart:end However, while fetching bytes, it uses bytessstart+1 instead of bytessstart+i. This causes the return string to be composed of sstartend-start. The result of this function is then...

OESA-2022-1558 gnulib security update

Gnulib is a central location for common GNU code, intended to be shared among GNU packages. It can be used to improve portability and other functionality in your programs. Security Fixes: The converttodecimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow...

PT-2022-36838

Name of the Vulnerable Software and Affected Versions No specific software or version information is provided in the input descriptions. Description A heap-buffer-overflow WRITE 1 crash has been reported, indicating a potential issue with memory handling. The crash state involves...

TWAPOracle.getRate does not scale the ratio

Handle cmichel Vulnerability details The TWAPOracle.getRate function simply performs an integer division to compute the rate. function getRate public view returns uint256 result uint256 tUSDInUSDV = consultUSDV; uint256 tUSDInVader = consultVADER; // @audit shouldn't this scale by 1e18 first?...

duckdb:parse_fuzz_test: Stack-buffer-overflow in bool duckdb::TryDecimalStringCast<duckdb::hugeint_t>

Project: https://github.com/duckdb/duckdb.git Detailed Report: https://oss-fuzz.com/testcase?key=5376498064818176 Project: duckdb Fuzzing Engine: libFuzzer Fuzz Target: parsefuzztest Job Type: libfuzzerasanduckdb Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address:...

GHSA-284F-F2HW-J2GX Server-Side Request Forgery vulnerability in concrete5

A Server-Side Request Forgery vulnerability was found in concrete5 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed...

Server-side Request Forgery (SSRF)

concrete5/concrete5 is vulnerable to server-side request forgery SSRF. An attacker can interact with local services through the decimal notation encoded IP addresses, bypassing the limitations in place for localhost...

CVE-2021-22958

A Server-Side Request Forgery vulnerability was found in concrete5 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0...

CVE-2021-22958

A Server-Side Request Forgery vulnerability was found in concrete5 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0...

Server side request forgery (ssrf)

A Server-Side Request Forgery vulnerability was found in concrete5 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0...

CVE-2021-22958

A Server-Side Request Forgery vulnerability was found in concrete5 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0...

CVE-2021-22958

A Server-Side Request Forgery vulnerability was found in concrete5 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0...

CVE-2021-22958

A Server-Side Request Forgery vulnerability was found in concrete5 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0...

CVE-2021-22958: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery vulnerability was found in concrete5 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.CVSSv2.0...

missing clamps for decimal args in external functions

Impact The following code does not properly validate that its input is in bounds. python @external def foox: decimal - decimal: return x Patches 0.3.0 / 2447 Workarounds Don't use decimal args...

GHSA-C7PR-343R-5C46 missing clamps for decimal args in external functions

Impact The following code does not properly validate that its input is in bounds. python @external def foox: decimal - decimal: return x Patches 0.3.0 / 2447 Workarounds Don't use decimal args...

Denial Of Service (DoS)

vyper is vulnerable to denial of service DoS. The library does not properly validate the bounds of decimal arguments in external functions, resulting in logical errors...

CVE-2021-41122

Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly validate the bounds of decimal arguments. The can lead to logic errors. This issue has been resolved in version 0.3.0...